The crypto exchange Coinbase
$4.03B
has confirmed losing around $300,000 in tokens after a mistake involving one of its corporate wallets used for decentralized exchange transactions.
Chief security officer Philip Martin said the problem was caused by a configuration change and only affected the company’s own funds.
He added that the token approvals were removed and the rest of the assets were moved to a new wallet. No customer balances were impacted.
Did you know?
Subscribe – We publish new crypto explainer videos every week!
What is AAVE in Crypto? (Beginner-Friendly Explainer)
The issue was first spotted by Deebeez, a security researcher from Venn Network. He explained in an August 13 post on X that Coinbase’s wallet interacted with the 0x Project’s “swapper” contract. This contract is meant for carrying out token swaps, not for holding approvals that allow tokens to be taken later.
Because the swapper contract can be called by anyone, these approvals made the funds vulnerable to being taken right away. Deebeez pointed out that similar problems have happened before with Zora-related claims on the Base network.
In those cases, attackers were able to take assets simply because they had been approved for the wrong type of contract.
Deebeez also shared screenshots that showed Coinbase approved several tokens on August 13, including Amp
$0.0036
, DEXTools
$0.4902
, MyOneProtocol, and Swell Network. Later, a maximal extractable value (MEV) bot used the swapper contract to move those tokens from Coinbase’s fee receiver wallet into its own accounts.
Recently, Odin.fun lost 58.2 BTC, worth around $7 million, in a liquidity exploit. How did that happen? Read the full story.
